<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
    <title>ShellCheck: SC2087 – Quote `EOF` to make here document expansions happen on the server side rather than on the client.</title>
    <link rel="stylesheet" href="css/bootstrap.min.css" />
  </head>
  <body style="margin-left: auto; margin-right: auto; max-width: 800px">
    <h1>SC2087 – ShellCheck Wiki</h1>
    <a href="https://github.com/koalaman/shellcheck/wiki/SC2087">See this page on GitHub</a>
    <p style="display: none"><a href="index.html">Sitemap</a></p>
    <hr />
    <h2
id="quote-eof-to-make-here-document-expansions-happen-on-the-server-side-rather-than-on-the-client">Quote
<code>EOF</code> to make here document expansions happen on the server
side rather than on the client.</h2>
<h3 id="problematic-code">Problematic code:</h3>
<div class="sourceCode" id="cb1"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb1-1"><a href="SC2087.html#cb1-1" aria-hidden="true" tabindex="-1"></a><span class="fu">ssh</span> host.example.com <span class="op">&lt;&lt; EOF</span></span>
<span id="cb1-2"><a href="SC2087.html#cb1-2" aria-hidden="true" tabindex="-1"></a><span class="st">  echo &quot;Logged in on </span><span class="va">$HOSTNAME</span><span class="st">&quot;</span></span>
<span id="cb1-3"><a href="SC2087.html#cb1-3" aria-hidden="true" tabindex="-1"></a><span class="op">EOF</span></span></code></pre></div>
<h3 id="correct-code">Correct code:</h3>
<div class="sourceCode" id="cb2"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb2-1"><a href="SC2087.html#cb2-1" aria-hidden="true" tabindex="-1"></a><span class="fu">ssh</span> host.example.com <span class="op">&lt;&lt; &quot;EOF&quot;</span></span>
<span id="cb2-2"><a href="SC2087.html#cb2-2" aria-hidden="true" tabindex="-1"></a><span class="st">  echo &quot;Logged in on $HOSTNAME&quot;</span></span>
<span id="cb2-3"><a href="SC2087.html#cb2-3" aria-hidden="true" tabindex="-1"></a><span class="op">EOF</span></span></code></pre></div>
<h3 id="rationale">Rationale:</h3>
<p>When the end token of a here document is unquoted, parameter
expansion and command substitution will happen on in contents of the
here doc.</p>
<p>This means that before sending the commands to the server, the client
replaces <code>$HOSTNAME</code> with localhost, thereby sending
<code>echo "Logged in on localhost"</code> to the server. This has the
effect of printing the client's hostname instead of the server's.</p>
<p>Scripts with any kind of variable use are especially problematic
because all references will be expanded before the script run. For
example,</p>
<div class="sourceCode" id="cb3"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb3-1"><a href="SC2087.html#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="fu">ssh</span> host <span class="op">&lt;&lt; EOF</span></span>
<span id="cb3-2"><a href="SC2087.html#cb3-2" aria-hidden="true" tabindex="-1"></a><span class="st">  x=&quot;</span><span class="va">$(</span><span class="fu">uname</span> <span class="at">-a</span><span class="va">)</span><span class="st">&quot;</span></span>
<span id="cb3-3"><a href="SC2087.html#cb3-3" aria-hidden="true" tabindex="-1"></a><span class="st">  echo &quot;</span><span class="va">$x</span><span class="st">&quot;</span></span>
<span id="cb3-4"><a href="SC2087.html#cb3-4" aria-hidden="true" tabindex="-1"></a><span class="op">EOF</span></span></code></pre></div>
<p>will never print anything, neither client nor server details, since
before evaluation, it will be expanded to:</p>
<div class="sourceCode" id="cb4"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb4-1"><a href="SC2087.html#cb4-1" aria-hidden="true" tabindex="-1"></a>  <span class="va">x</span><span class="op">=</span><span class="st">&quot;Linux localhost ... x86_64 GNU/Linux&quot;</span></span>
<span id="cb4-2"><a href="SC2087.html#cb4-2" aria-hidden="true" tabindex="-1"></a>  <span class="bu">echo</span> <span class="st">&quot;&quot;</span></span></code></pre></div>
<p>By quoting the here token, local expansion will not take place, so
the server sees <code>echo "Logged in on $HOSTNAME"</code> which is
expanded and printed with the server's hostname, which is usually the
intention.</p>
<h3 id="exceptions">Exceptions:</h3>
<p>If the client should expand some or all variables, this message can
and should be ignored.</p>
<p>To expand a mix of local and remote variables, the here doc end token
should be unquoted, and the remote variables should be escaped, e.g.</p>
<div class="sourceCode" id="cb5"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb5-1"><a href="SC2087.html#cb5-1" aria-hidden="true" tabindex="-1"></a><span class="fu">ssh</span> host.example.com <span class="op">&lt;&lt; EOF</span></span>
<span id="cb5-2"><a href="SC2087.html#cb5-2" aria-hidden="true" tabindex="-1"></a><span class="st">  echo &quot;Logged in on </span><span class="dt">\$</span><span class="st">HOSTNAME from </span><span class="va">$HOSTNAME</span><span class="st">&quot;</span></span>
<span id="cb5-3"><a href="SC2087.html#cb5-3" aria-hidden="true" tabindex="-1"></a><span class="op">EOF</span></span></code></pre></div>
    <hr />
    <p style='font-size: 80%'><a href="../index.html">ShellCheck</a> is a static analysis tool for shell scripts. This page is part of its documentation.</p>
  </body>
</html>


